AI Agents Turn a China-Linked Cyber Operation Into a Global Threat

A China-nexus adversary known as VAPOR PANDA used an AI-driven intrusion framework to target more than 200 organizations across at least 14 countries, CrowdStrike said. The campaign ran across an 11-day window beginning October 17, 2026, and CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations.

The findings, published October 29, 2026, show how an AI system can help coordinate many cyber operations at once. The framework, called ARTEX, ran primarily on the Chinese-developed DeepSeek large language model and was supplemented by a second subscription-based commercial large language model. CrowdStrike Intelligence could not confirm the identity of that second model.

One Controller Managed Multiple Intrusions

CrowdStrike OverWatch observed the exploitation activity coming from a single ARTEX controller, which CrowdStrike Intelligence linked to VAPOR PANDA infrastructure. The controller periodically exposed adversary tooling, target files, and agent transcripts, giving investigators a view of how the operation worked.

Those records pointed to multiple engagements, known as tasks within the framework, running against multiple targets. ARTEX paired a main agent with subordinate planner and worker agents that shared a graph of facts, findings, and goals. The agents moved each engagement from initial access through host reconnaissance and lateral movement.

The system still kept a human in the loop. Recovered transcripts showed an operator issuing instructions in Chinese, marked with a label translated as “human instruction.” The instructions were timestamped in China Standard Time and told the agents to create web shells, extract domain administrator credentials, and check endpoint sensor coverage.

That combination matters because the operator did not need to direct every individual action. The framework could organize information and pass work among several agents, while the human supplied instructions and goals.

What VAPOR PANDA Did After Gaining Access

At the nine organizations with confirmed post-exploitation activity, VAPOR PANDA gained access, deployed the BLOODALCHEMY backdoor, and moved into credential spraying, network scanning, and reconnaissance. The adversary also ran password-spraying and credential-scanning activity against at least 12 more organizations.

Those additional targets included U.S.-based think tanks and government entities in Europe. CrowdStrike also reported extensive intrusions inside the foreign ministries of two Latin America-based countries, while VAPOR PANDA likely breached a third foreign ministry.

The activity reached across several regions and sectors. VAPOR PANDA staged target files for later use against foreign ministries in Central America and Asia, and compromised a Middle East-based interior ministry.

One engagement focused on a single European country and its foreign ministry, presidency, and prime minister’s office, along with defense, justice, finance, and intelligence entities. Another targeted 19 U.S.-based organizations across the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.

Telecommunications providers in the U.S., Belgium, and the Philippines were also compromised. The range of targets shows that ARTEX was used across government, communications, research, and major industrial sectors rather than for one narrow objective.

The Scale Came From Automation

In a single intrusion, the planning agents consumed roughly 1.4 billion input tokens. CrowdStrike said that figure points to the scale of the automated activity and implies that the operation as a whole consumed far more.

The report also detailed the agents’ work at two U.S.-based pharmaceutical organizations. Even without directing every step by hand, the framework could process findings, pursue goals, and continue through stages of an engagement. That gives one controller a way to manage activity against many targets during the same campaign.

Junfeng Yang, a computer science professor at Columbia University, described the problem in simple terms: “AI is making the old vulnerabilities cheaper to discover and exploit, but on the other side, the defense side… that’s not sped up as much.”

Yang added, “While AI can generate a security patch quickly, it still takes a lot of human time to review and test it and coordinate disclosure and deployment across multiple organizations. Humans don’t work at the speed of AI. That is the asymmetry right now.”

That gap sits at the center of the VAPOR PANDA case. ARTEX connected a main agent, planner agents, worker agents, a human operator, and a shared store of findings, allowing the operation to cover more than 200 organizations in a short window.

Responsibility Still Rests With People

The human role also matters when assigning responsibility. Cybersecurity expert and consultant Joseph Steinberg said, “I think that if an AI goes out and hacks, the parties that own it should be held responsible criminally.”

Steinberg rejected the idea that the system itself should carry the blame: “The assertion that the AI is an autonomous being is insane.” He added that profits go to the AI’s owners, not the AI, because “It’s their entity.”

For now, the VAPOR PANDA campaign presents a clear picture of AI-assisted intrusion: a human operator gave instructions, ARTEX coordinated specialized agents, and the system pursued access, discovery, credential activity, and movement across a large collection of targets. CrowdStrike’s confirmed count was nine organizations with post-exploitation activity, but the wider campaign reached more than 200 organizations in at least 14 countries.

Stay connected via Google News

Follow us for the latest AI News